Computer and Network Security are very dynamic fields, with new threats and defenses appearing daily. There is a growing demand for competent workforce in these fields throughout US industries and government agencies, with main job requirements being experience and practical skills. Many universities teach security topics at the undergraduate and the graduate level. But in sharp contrast to market trends, security education in universities is often conducted in classrooms, with use of textbooks, blackboard and slides, and with focus on theory and case studies. The resulting students are not fully prepared to meet real security challenges in the real world. This approach also reduces retention in Computer Science, as passive learning lessens student motivation.
In our research we create publicly available education materials for active learning of cybersecurity concepts. Such learning increases student engagement and motivation, and helps them internalize concepts they learned in class through exercising them on a testbed, in a safe but realistic network environment.
Our research also focuses on understanding how people learn with testbeds, and overcoming technical challenges in this learning through automated intervention.
With a team of cyber security educators, we have developed homework exercises that utilize DeterLab testbed to demonstrate various attacks and defenses. All the exercises are publicly available at DeterLab's education Web page.
Cybersecurity is a unique field of science and engineering, because its main challenges are not solely dictated by technological limitations or the theoretical complexity of the underlying problems. Rather, cybersecurity advances are driven by the clash of minds -- researchers create new defenses and criminals adapt their attacks in response. This adversarial game is at the heart of each cybersecurity challenge, but it is sadly absent from cybersecurity education. The ACM defines three types of learning outcomes in their Computer Science Curricula 2013:
As students advance on their learning path from familiarity to assessment, student engagement, interest and retention increase. Currently, many security classes are taught the old-fashioned way, using textbooks and lectures, with focus on theory and case studies. This leads only to familiarity learning outcomes and results in narrowly educated and poorly trained professionals. Commendably, some classes include hands-on exercises to demonstrate concepts taught in lectures, and lead to usage learning outcomes. This is necessary but not sufficient. Students acquire some practical skills performing these exercises but do not get to experience the adversarial nature of the field, nor do they get to apply their newly acquired skills to novel situations where success depends on their inventiveness, ability to make the right decisions quickly and work in a team. These skills are needed daily in a cybersecurity career. Accordingly, the better equipped our students are with these skills when they graduate, the more quickly and competently they will enter the work force.
We aim to revitalize security education through class capture-the-flag exercises (CCTFs). These are small-scoped Capture-the-Flag (CTF) exercises, designed to require a few weeks of preparation from students and to be conducted in as little time as a two-hour class. They engage teams of students in attack-defense scenarios. Each team plays both the defense and the attack role, which enables them to understand and acquire the adversarial thinking model needed for a cybersecurity career. We have designed CCTFs to require minimal support from teachers -- their setup and scoring is automated and they are conducted on the DeterLab testbed. Each CCTF focuses on one security topic (e.g., cryptography, exploits, denial-of-service, etc.). This scoping enables students to exercise skills they have recently learned in class and possibly practiced through hands-on exercises. After each CCTF, a teacher leads an in-class post-mortem analysis on the event, enabling students to identify what they did right or wrong and to improve for future competitions. We believe that these exercises will help students achieve the assessment learning outcome and own the material they learned in class at a deeper, more masterful level -- while also having a lot of fun.
Information Sheet for research participants